CVE-2026-25541

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM DataPower Gateway ausnutzen, um einen Denial of Service Angriff durchzuführen.

# Details In the unique reclaim path of `BytesMut::reserve`, the condition ```rs if v_capacity >= new_cap + offset ``` uses an unchecked addition. When `new_cap + offset` overflows `usize` in release builds, this condition may incorrectly pass, causing `self.cap` to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as `spare_capacity_mut()` then trust this corrupted `cap` value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. ## PoC ```rs use bytes::*; fn main() { let mut a = BytesMut::from(&b"hello world"[..]); let mut b = a.split_off(5); // Ensure b becomes the unique owner of the backing storage drop(a); // Trigger overflow in new_cap + offset inside reserve b.reserve(usize::MAX - 6); // This call relies on the corrupted cap and may cause UB & HBO b.put_u8(b'h'); } ``` # Workarounds Users of `BytesMut::reserve` are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply. This vulnerability is also known as [RUSTSEC-2026-0007](https://rustsec.org/advisories/RUSTSEC-2026-0007.html).

In the unique reclaim path of `BytesMut::reserve`, the condition ```rs if v_capacity >= new_cap + offset ``` uses an unchecked addition. When `new_cap + offset` overflows `usize` in release builds, this condition may incorrectly pass, causing `self.cap` to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as `spare_capacity_mut()` then trust this corrupted `cap` value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. ## PoC ```rs use bytes::*; fn main() { let mut a = BytesMut::from(&b"hello world"[..]); let mut b = a.split_off(5); // Ensure b becomes the unique owner of the backing storage drop(a); // Trigger overflow in new_cap + offset inside reserve b.reserve(usize::MAX - 6); // This call relies on the corrupted cap and may cause UB & HBO b.put_u8(b'h'); } ``` # Workarounds Users of `BytesMut::reserve` are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply.